v0.4.3

Platform Orchestrator Helm chart 0.4.3

This patch completes the operational qualification of the configurable Casbin
RBAC release. It carries forward the NATS bootstrap fix from 0.4.2 and fixes
the runner gateway's default NATS endpoint lookup.

Included versions

Component	Version
Control plane	v2.0.0
Data plane	v3.0.0
IAM	v2.1.0
Runner	v3.0.0
Console	v1.1.0
Kubernetes runner chart	0.3.0
NATS Helm dependency	2.14.0

What changed

• The runner gateway now reads the NATS endpoint from the documented
  global.config.NATS_URL value used by the rest of the chart.
• The runner gateway contract now asserts the exact rendered NATS endpoint.
• The bootstrap readiness check uses authenticated NATS protocol RTT and does
  not require $SYS account permissions.

Upgrade

Upgrade normally; no application or database migration is needed from 0.4.1
or 0.4.2. Installations upgrading from a supported SpiceDB-based release
still receive the automatic, fail-closed Casbin migration described in the
SpiceDB-to-Casbin upgrade procedure.

Qualification

• The rendered chart passed all chart and release contracts, including exact
  runner gateway NATS configuration and the bundled NATS CLI command.
• The bootstrap Job completed against the token-protected WX1 NATS service.
• The console, IAM, runner gateway, and supporting workloads completed their
  WX1 rollouts with all replicas ready.